MALICIOUS — 23243514133.pdf

MALICIOUS — 23243514133.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: ada23377e91b78bc7b75dd3fd6ee40acf05ddda3a21a6f231c5d99b4596212d3
SHA-1: c0f6ec71cfdf87abea193d22b6ac50f31df33ede
MD5: 15f7f540bc6e5333ff9197105553f358
ssdeep: 1536:kBK3s+9xssQLrM1zEEM71N6YdhIJ6qt6HAiWxikfWOpOwrKWTqM3JJbBRL:b6/rM1zEEMhN6YfQb6Gi5wrpqoJFv
TLSH: T13339D0F321A3ED4C7A46CB576AF60168508DDEC52153DBA055C4FABCC57C9BE6E00821
Submitted as: 23243514133.pdf
File type: pdf · Size: 87310 bytes
Verdict: malicious (98/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://jadeite.ru/images/file/kugororapizeduvusulono.pdf - network signal, weight 0.70, confidence 0.80
Contacted 13 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://mytutr.com/wp-content/plugins/super-forms/uploads/php/files/696357855692e881c95dabc3e61c1360/78839023778.pdf, http://tecsun-moscow.ru/docs/file/dexudusokilevedupakimere.pdf, http://dobre-jaja.com/Upload/file/patenafinejevozusekoveleb.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9664 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep._dosvc._tcp.local
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep(1)._dosvc._tcp.local
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt

Dropped files

/opt/CAPEv2/storage/analyses/34915/files/4bf08a5c8e31af245a766ca06a8caeba3491ee29ffb5d07709e06bb9e754793e - 4bf08a5c8e31af245a766ca06a8caeba3491ee29ffb5d07709e06bb9e754793e
/opt/CAPEv2/storage/analyses/34915/files/8679d67c8985cdccd16ccddf534ee8f902708a11c932394321d9271376d90f56 - 8679d67c8985cdccd16ccddf534ee8f902708a11c932394321d9271376d90f56
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=computer+science+distilled+pdf+download
https://mytutr.com/wp-content/plugins/super-forms/uploads/php/files/696357855692e881c95dabc3e61c1360/78839023778.pdf
http://tecsun-moscow.ru/docs/file/dexudusokilevedupakimere.pdf
http://dobre-jaja.com/Upload/file/patenafinejevozusekoveleb.pdf
http://jadeite.ru/images/file/kugororapizeduvusulono.pdf
https://www.karavanlakesfet.com/wp-content/plugins/super-forms/uploads/php/files/921c497ef0f9c4dfad9b86b8d4704cc9/wulosajelafudi.pdf
https://efficimm.fr/userfiles/files/bemumutumom.pdf
http://hanbangrd.com/userfiles/file/20210812194152_1022926565.pdf
http://pavcargo.ru/wp-content/plugins/super-forms/uploads/php/files/40ac53a96c04185e423c4b3bfc127d61/15474739400.pdf
http://alacarte-design.de/userfiles/file/48621479271.pdf
https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/g15mili9ho6j50ff4672rtgrcj/33136999216.pdf
http://www.jindatunnel.com/up_files/file/gabowo.pdf
http://www.marsagri.com/wp-content/plugins/formcraft/file-upload/server/content/files/160abf17c8b6a4---tadotulerujajen.pdf
https://barcelonamedicalcenter.com/files/galeria/files/vobilabakarutu.pdf
http://syarmarka.ru/userfiles/files/61364024404.pdf
http://nedirajtebosnu.net/userfiles/file/bafek.pdf
https://wittnebel.dk/file/20200591059.pdf
http://viprealestatebrokers.com/userfiles/files/luzarezurolotoxetosoj.pdf
https://safrano.pl/userfiles/file/zokuweliwadomiwes.pdf
http://unicaconsultoriarh.com/images/files/87482577287.pdf
https://beautydent.hu/editor_up/zoraxodeko.pdf
http://veterinariogiardinelli.it/userfiles/files/bitajonuxobajapalefukimax.pdf
http://www.viksexteriors.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d4229e2b28b---potatowefewiraxatikejuna.pdf
http://studiopiergentili.it/userfiles/files/fubewa.pdf
https://k-barrierfree.com/FileData/ckfinder/files/20210710_FEA77264282A000F.pdf

Embedded domains

feedproxy.google.com
mytutr.com
tecsun-moscow.ru
dobre-jaja.com
jadeite.ru
www.karavanlakesfet.com
efficimm.fr
hanbangrd.com
pavcargo.ru
alacarte-design.de
www.stamfordtaxis.com
www.jindatunnel.com
www.marsagri.com
barcelonamedicalcenter.com
syarmarka.ru
nedirajtebosnu.net
viprealestatebrokers.com
safrano.pl
unicaconsultoriarh.com
veterinariogiardinelli.it
www.viksexteriors.com
studiopiergentili.it
k-barrierfree.com
bringem.de
www.w3.org

Embedded IP addresses

4.150.223.101
52.123.252.216
52.110.12.10
172.215.188.225
4.230.171.124
20.247.184.197
74.178.240.61
72.153.5.129
203.26.79.13
20.112.250.133
135.234.160.244
52.123.129.14
40.99.134.2

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report